tabby-rdp 0.1.0

package/dist/rdcleanpath.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startRDCleanPathProxy = startRDCleanPathProxy;
+// RDCleanPath proxy for the IronRDP web client, running inside Tabby's renderer.
+// The WASM client talks WebSocket to this proxy; the proxy opens the upstream stream
+// (a plain socket here, an SSH direct-tcpip channel later), forwards the X.224 request,
+// terminates TLS, hands the server cert chain back to the client (for CredSSP), then relays.
+const tls = require("tls");
+const crypto_1 = require("crypto");
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { WebSocketServer } = require('ws');
+const VERSION_1 = 3390;
+const GENERAL_ERROR = 1;
+// ---- minimal DER -------------------------------------------------------------------------------
+function derLength(n) {
+    if (n < 0x80) {
+        return Buffer.from([n]);
+    }
+    const bytes = [];
+    for (let v = n; v > 0; v = Math.floor(v / 256)) {
+        bytes.unshift(v & 0xff);
+    }
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+function tlv(tag, content) {
+    return Buffer.concat([Buffer.from([tag]), derLength(content.length), content]);
+}
+function derInteger(n) {
+    let hex = n.toString(16);
+    if (hex.length % 2) {
+        hex = '0' + hex;
+    }
+    let b = Buffer.from(hex, 'hex');
+    if (b[0] & 0x80) {
+        b = Buffer.concat([Buffer.from([0]), b]);
+    }
+    return tlv(0x02, b);
+}
+const seq = (...items) => tlv(0x30, Buffer.concat(items));
+const explicit = (n, inner) => tlv(0xa0 | n, inner);
+const octets = (b) => tlv(0x04, b);
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+function readTlv(buf, off) {
+    if (buf.length < off + 2) {
+        return null;
+    }
+    let len = buf[off + 1];
+    let p = off + 2;
+    if (len & 0x80) {
+        const k = len & 0x7f;
+        if (buf.length < p + k) {
+            return null;
+        }
+        len = 0;
+        for (let i = 0; i < k; i++) {
+            len = len * 256 + buf[p++];
+        }
+    }
+    return { tag: buf[off], start: p, end: p + len };
+}
+function decodeRequest(buf) {
+    const outer = readTlv(buf, 0);
+    if (!outer || outer.tag !== 0x30) {
+        throw new Error('RDCleanPath: not a SEQUENCE');
+    }
+    const req = {};
+    let p = outer.start;
+    while (p < outer.end) {
+        const field = readTlv(buf, p);
+        const inner = readTlv(buf, field.start);
+        const value = buf.subarray(inner.start, inner.end);
+        switch (field.tag & 0x1f) {
+            case 0:
+                req.version = value.readUIntBE(0, value.length);
+                break;
+            case 2:
+                req.destination = value.toString('utf8');
+                break;
+            case 3:
+                req.proxyAuth = value.toString('utf8');
+                break;
+            case 6:
+                req.x224 = Buffer.from(value);
+                break;
+        }
+        p = field.end;
+    }
+    return req;
+}
+function encodeResponse(x224, certChain, serverAddr) {
+    return seq(explicit(0, derInteger(VERSION_1)), explicit(6, octets(x224)), explicit(7, seq(...certChain.map(octets))), explicit(9, utf8(serverAddr)));
+}
+function encodeError() {
+    return seq(explicit(0, derInteger(VERSION_1)), explicit(1, seq(explicit(0, derInteger(GENERAL_ERROR)))));
+}
+// ---- upstream handshake ------------------------------------------------------------------------
+// Reads exactly one TPKT-framed PDU (the X.224 Connection Confirm) without consuming TLS bytes.
+function readTpkt(stream) {
+    return new Promise((resolve, reject) => {
+        let acc = Buffer.alloc(0);
+        const cleanup = () => {
+            stream.off('data', onData);
+            stream.off('error', onError);
+            stream.off('close', onClose);
+        };
+        const onError = (e) => { cleanup(); reject(e); };
+        const onClose = () => { cleanup(); reject(new Error('upstream closed during X.224')); };
+        const onData = (chunk) => {
+            acc = Buffer.concat([acc, chunk]);
+            if (acc.length < 4) {
+                return;
+            }
+            const len = acc.readUInt16BE(2);
+            if (acc.length < len) {
+                return;
+            }
+            stream.pause();
+            cleanup();
+            if (acc.length > len) {
+                stream.unshift(acc.subarray(len));
+            }
+            resolve(acc.subarray(0, len));
+        };
+        stream.on('data', onData);
+        stream.on('error', onError);
+        stream.on('close', onClose);
+    });
+}
+function certChainOf(socket) {
+    const chain = [];
+    let cert = socket.getPeerCertificate(true);
+    const seen = new Set();
+    while (cert?.raw && !seen.has(cert.fingerprint256)) {
+        seen.add(cert.fingerprint256);
+        chain.push(cert.raw);
+        cert = cert.issuerCertificate;
+    }
+    return chain;
+}
+// ---- proxy -------------------------------------------------------------------------------------
+/**
+ * TLS for servers whose certificate only allows key encipherment, like Windows' self-signed RDP certificate.
+ * BoringSSL (Electron) enforces the certificate's key usage, and every ECDHE or TLS 1.3 handshake needs the
+ * digital-signature bit, so only TLS 1.2 with RSA key exchange works with such a certificate (other RDP
+ * clients use OpenSSL, which doesn't enforce it).
+ */
+const KEY_ENCIPHERMENT_ONLY_TLS = {
+    maxVersion: 'TLSv1.2',
+    ciphers: 'AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256',
+};
+/** Sends the client's X.224 request upstream, reads the confirm, then does TLS there. */
+async function handshake(openUpstream, destination, x224Request, legacyTls) {
+    const raw = await openUpstream(destination);
+    try {
+        raw.write(x224Request);
+        const x224 = await readTpkt(raw);
+        const upstream = tls.connect({ socket: raw, rejectUnauthorized: false, ...legacyTls ? KEY_ENCIPHERMENT_ONLY_TLS : {} });
+        await new Promise((resolve, reject) => {
+            upstream.once('secureConnect', resolve);
+            upstream.once('error', reject);
+        });
+        return { raw, upstream, x224 };
+    }
+    catch (e) {
+        raw.destroy();
+        throw e;
+    }
+}
+async function startRDCleanPathProxy(openUpstream, log = () => { }) {
+    const token = (0, crypto_1.randomBytes)(24).toString('hex');
+    // Set once the server turned out to need KEY_ENCIPHERMENT_ONLY_TLS; later connections start with it.
+    let legacyTls = false;
+    const wss = new WebSocketServer({ host: '127.0.0.1', port: 0 });
+    await new Promise((resolve, reject) => {
+        wss.once('listening', resolve);
+        wss.once('error', reject);
+    });
+    wss.on('connection', (ws) => {
+        let buf = Buffer.alloc(0);
+        let stage = 'hello';
+        const early = [];
+        let upstream = null;
+        let raw = null;
+        const fail = (why) => {
+            log(`RDCleanPath failed: ${why}`);
+            try {
+                ws.send(encodeError());
+            }
+            catch { }
+            ws.close();
+            upstream?.destroy();
+            raw?.destroy();
+        };
+        ws.on('message', async (data) => {
+            if (stage === 'relay') {
+                upstream.write(data);
+                return;
+            }
+            if (stage === 'handshake') {
+                early.push(data);
+                return;
+            }
+            buf = Buffer.concat([buf, data]);
+            const outer = readTlv(buf, 0);
+            if (!outer || buf.length < outer.end) {
+                return;
+            }
+            stage = 'handshake';
+            try {
+                const req = decodeRequest(buf.subarray(0, outer.end));
+                if (req.version !== VERSION_1 || !req.x224 || !req.destination) {
+                    return fail('malformed request');
+                }
+                if (req.proxyAuth !== token) {
+                    return fail('bad token');
+                }
+                let up;
+                try {
+                    up = await handshake(openUpstream, req.destination, req.x224, legacyTls);
+                }
+                catch (e) {
+                    if (legacyTls || !/KEY_USAGE_BIT_INCORRECT/.test(e?.message ?? '')) {
+                        throw e;
+                    }
+                    // The X.224 exchange is spent on that connection: start over on a fresh one.
+                    log('TLS: the server certificate only allows key encipherment; using TLS 1.2 with RSA key exchange');
+                    legacyTls = true;
+                    up = await handshake(openUpstream, req.destination, req.x224, legacyTls);
+                }
+                raw = up.raw;
+                upstream = up.upstream;
+                const x224 = up.x224;
+                ws.send(encodeResponse(x224, certChainOf(upstream), req.destination));
+                stage = 'relay';
+                upstream.on('data', (d) => ws.send(d));
+                upstream.on('close', () => ws.close());
+                upstream.on('error', (e) => { log(`upstream error: ${e.message}`); ws.close(); });
+                for (const d of early) {
+                    upstream.write(d);
+                }
+                log(`RDCleanPath relay up to ${req.destination}`);
+            }
+            catch (e) {
+                fail(e?.message ?? String(e));
+            }
+        });
+        ws.on('close', () => {
+            upstream?.destroy();
+            raw?.destroy();
+        });
+    });
+    const { port } = wss.address();
+    return { url: `ws://127.0.0.1:${port}`, token, close: () => wss.close() };
+}
+//# sourceMappingURL=rdcleanpath.js.map

package/dist/rdcleanpath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rdcleanpath.js","sourceRoot":"","sources":["../src/rdcleanpath.ts"],"names":[],"mappings":";;AAiMA,sDAoFC;AArRD,iFAAiF;AACjF,qFAAqF;AACrF,wFAAwF;AACxF,6FAA6F;AAC7F,2BAA0B;AAC1B,mCAAoC;AAIpC,8DAA8D;AAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAA;AACtB,MAAM,aAAa,GAAG,CAAC,CAAA;AAUvB,mGAAmG;AAEnG,SAAS,SAAS,CAAE,CAAS;IACzB,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,GAAG,CAAE,GAAW,EAAE,OAAe;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAE,CAAS;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjB,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QACd,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AACnE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;AACnE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC1C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;AAI7D,SAAS,OAAO,CAAE,GAAW,EAAE,GAAW;IACtC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAA;IACf,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;QACpB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACf,CAAC;QACD,GAAG,GAAG,CAAC,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;IACL,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,CAAA;AACpD,CAAC;AAID,SAAS,aAAa,CAAE,GAAW;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IACnB,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAE,CAAA;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QAClD,QAAQ,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC;gBAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAK;YAC9D,KAAK,CAAC;gBAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAK;YACvD,KAAK,CAAC;gBAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAK;YACrD,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAK;QAChD,CAAC;QACD,CAAC,GAAG,KAAK,CAAC,GAAG,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAE,IAAY,EAAE,SAAmB,EAAE,UAAkB;IAC1E,OAAO,GAAG,CACN,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,EAClC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EACzB,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAC1C,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAChC,CAAA;AACL,CAAC;AAED,SAAS,WAAW;IAChB,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5G,CAAC;AAED,mGAAmG;AAEnG,gGAAgG;AAChG,SAAS,QAAQ,CAAE,MAAc;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,EAAE;YACjB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChC,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAA;QACtD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA,CAAC,CAAC,CAAA;QACtF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC7B,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;YACjC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAM;YACV,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACnB,OAAM;YACV,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;YACT,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YACrC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QACjC,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACN,CAAC;AAED,SAAS,WAAW,CAAE,MAAqB;IACvC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAQ,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,mGAAmG;AAEnG;;;;;GAKG;AACH,MAAM,yBAAyB,GAA0B;IACrD,UAAU,EAAE,SAAS;IACrB,OAAO,EAAE,iEAAiE;CAC7E,CAAA;AAED,yFAAyF;AACzF,KAAK,UAAU,SAAS,CAAE,YAA6B,EAAE,WAAmB,EAAE,WAAmB,EAAE,SAAkB;IACjH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9H,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;YACvC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAA;QACb,MAAM,CAAC,CAAA;IACX,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAE,YAA6B,EAAE,MAA6B,GAAG,EAAE,GAAE,CAAC;IAC7G,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,qGAAqG;IACrG,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC9B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAO,EAAE,EAAE;QAC7B,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,KAAK,GAAoC,OAAO,CAAA;QACpD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,QAAQ,GAAyB,IAAI,CAAA;QACzC,IAAI,GAAG,GAAkB,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;YACzB,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;YACjC,IAAI,CAAC;gBAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC;YACxC,EAAE,CAAC,KAAK,EAAE,CAAA;YACV,QAAQ,EAAE,OAAO,EAAE,CAAA;YACnB,GAAG,EAAE,OAAO,EAAE,CAAA;QAClB,CAAC,CAAA;QAED,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;YACpC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACpB,QAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACrB,OAAM;YACV,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAM;YACV,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBACnC,OAAM;YACV,CAAC;YACD,KAAK,GAAG,WAAW,CAAA;YACnB,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;gBACrD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC5B,CAAC;gBACD,IAAI,EAAyC,CAAA;gBAC7C,IAAI,CAAC;oBACD,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC5E,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBACd,IAAI,SAAS,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;wBACjE,MAAM,CAAC,CAAA;oBACX,CAAC;oBACD,6EAA6E;oBAC7E,GAAG,CAAC,+FAA+F,CAAC,CAAA;oBACpG,SAAS,GAAG,IAAI,CAAA;oBAChB,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC5E,CAAC;gBACD,GAAG,GAAG,EAAE,CAAC,GAAG,CAAA;gBACZ,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAA;gBACtB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAA;gBACpB,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;gBACrE,KAAK,GAAG,OAAO,CAAA;gBACf,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC9C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;gBACtC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;gBACvF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACpB,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,CAAC;gBACD,GAAG,CAAC,2BAA2B,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;YACrD,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YACjC,CAAC;QACL,CAAC,CAAC,CAAA;QACF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAChB,QAAQ,EAAE,OAAO,EAAE,CAAA;YACnB,GAAG,EAAE,OAAO,EAAE,CAAA;QAClB,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;IAEF,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAiB,CAAA;IAC7C,OAAO,EAAE,GAAG,EAAE,kBAAkB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAA;AAC7E,CAAC"}

package/dist/remoteSetup.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareRemoteDesktop = prepareRemoteDesktop;
+const fs = require("fs");
+const path = require("path");
+// Runs as the SSH user; needs no root. Prints exactly one `RD_OK port=N user=U pass=P` or `RD_ERR <reason>` line.
+// The RDP password is generated once per remote user and kept in a 0600 file; grd reads credentials only
+// at startup, so grd is restarted only when its configuration actually changes (that drops live sessions).
+// (grdctl takes the credentials as arguments, so they are briefly visible in the remote's process list.)
+const SETUP_SCRIPT = String.raw `
+say () { printf '%s\n' "$*"; }
+fail () { say "RD_ERR $*"; exit 0; }
+command -v grdctl >/dev/null 2>&1 || fail "GNOME Remote Desktop (grdctl) is not installed"
+command -v gnome-shell >/dev/null 2>&1 || fail "gnome-shell is not installed"
+if systemctl --user is-active -q gnome-remote-desktop.service; then
+    fail "a desktop-session GNOME Remote Desktop is already running for this user"
+fi
+D="$HOME/.local/share/tabby-remote-desktop"
+mkdir -p "$D" && chmod 700 "$D" || fail "could not create $D"
+if [ ! -s "$D/tls.key" ]; then
+    openssl req -new -newkey rsa:3072 -days 3650 -nodes -x509 -subj "/CN=$(hostname)" \
+        -keyout "$D/tls.key" -out "$D/tls.crt" >/dev/null 2>&1 || fail "could not create a TLS certificate"
+fi
+# 'desk' support (setting, off by default): interactive SSH logins start inside a shareable session (trd-pty,
+# or tmux), so 'desk' can attach this exact console to a terminal on the desktop. Rewritten on every connect;
+# opt out per login with TABBY_NO_SESSION=1. When the setting is off, the hook and helpers are removed.
+if [ "${"$"}{TRD_DESK:-0}" = 1 ]; then
+mkdir -p "$D/bin"
+cat > "$D/login.sh" <<'TRD_EOF'
+# tabby-rdp ('desk' setting): interactive SSH logins run inside a shareable session, so 'desk' in Tabby can
+# bring this console to the remote desktop. Backend ("native" trd-pty or "tmux") is in $TRD_HOME/backend.
+# Set TABBY_NO_SESSION=1 (or TABBY_NO_TMUX=1) to skip; turning 'desk' off in Tabby removes this hook.
+TRD_HOME="$HOME/.local/share/tabby-remote-desktop"
+case ":$PATH:" in *":$TRD_HOME/bin:"*) ;; *) PATH="$TRD_HOME/bin:$PATH"; export PATH ;; esac
+case $- in *i*) ;; *) return 0 ;; esac
+if [ -n "$SSH_TTY" ] && [ -z "$TMUX" ] && [ -z "$TRD_SESSION" ] && [ -z "$TABBY_NO_TMUX$TABBY_NO_SESSION" ]; then
+    TRD_BACKEND=$(cat "$TRD_HOME/backend" 2>/dev/null)
+    if [ "$TRD_BACKEND" = native ] && command -v python3 >/dev/null 2>&1; then
+        "$TRD_HOME/bin/trd-pty" new
+        case $? in 0) exit ;; 3) TRD_BACKEND=tmux ;; esac   # 3: no session could be started
+    fi
+    if [ "$TRD_BACKEND" != native ] && command -v tmux >/dev/null 2>&1; then
+        tmux -L tabby -f "$TRD_HOME/tmux.conf" new-session && exit
+    fi
+fi
+TRD_EOF
+cat > "$D/tmux.conf" <<'TRD_EOF'
+# tmux server for SSH logins (tabby-rdp 'desk'). Your ~/.tmux.conf is applied on top.
+set -g status off
+# Like a plain SSH login: the session ends when its last client (console or desktop terminal) goes away.
+set -g destroy-unattached on
+# Console and desktop terminal can differ in size: follow whichever was used last. Focus reports make
+# switching back (Tabby focuses the console) count as use, so the window resizes right away.
+set -g window-size latest
+set -g focus-events on
+# Lets 'desk' reach Tabby from inside tmux.
+set -g allow-passthrough on
+# Keep the terminal's own scrollback (no alternate screen).
+set -ga terminal-overrides ',*:smcup@:rmcup@'
+source-file -q ~/.tmux.conf
+TRD_EOF
+cat > "$D/bin/desk" <<'TRD_EOF'
+#!/bin/sh
+# desk: open this machine's desktop in Tabby, with this console (its shared session) waiting in a terminal there.
+b64 () { printf %s "$1" | base64 | tr -d '\n'; }
+KIND= SESSION= SOCKET=
+if [ -n "$TRD_SESSION" ]; then
+    KIND=native SESSION=$TRD_SESSION SOCKET=$TRD_SOCKET
+elif [ -n "$TMUX" ]; then
+    KIND=tmux
+    SESSION=$(tmux display-message -p '#{session_name}' 2>/dev/null)
+    SOCKET=$(tmux display-message -p '#{socket_path}' 2>/dev/null)
+    tmux set-option -p allow-passthrough on 2>/dev/null
+fi
+SEQ=$(printf '\033]7777;desk;%s;%s;%s;%s\007' "$(b64 "$SESSION")" "$(b64 "$SOCKET")" "$(b64 "$PWD")" "$(b64 "$KIND")")
+if [ "$KIND" = tmux ]; then
+    printf '\033Ptmux;\033%s\033\\' "$SEQ"   # tmux only lets it through as passthrough
+else
+    printf '%s' "$SEQ"                       # trd-pty passes output through byte for byte
+fi
+TRD_EOF
+chmod 755 "$D/bin/desk"
+cat > "$D/bin/trd-pty" <<'TRD_PY_EOF'
+@@TRD_PTY_PY@@
+TRD_PY_EOF
+chmod 755 "$D/bin/trd-pty"
+printf '%s\n' "${"$"}{TRD_BACKEND:-native}" > "$D/backend"
+for rc in "$HOME/.bashrc" "$HOME/.zshrc"; do
+    [ -f "$rc" ] || continue
+    grep -qF '# tabby-remote-desktop' "$rc" && continue
+    # Only one line: turning desk off deletes exactly it, so on/off cycles leave the file as it was.
+    [ -z "$(tail -c1 "$rc")" ] || echo >> "$rc"
+    printf '[ -f "$HOME/.local/share/tabby-remote-desktop/login.sh" ] && . "$HOME/.local/share/tabby-remote-desktop/login.sh"  # tabby-remote-desktop\n' >> "$rc"
+done
+else
+    for rc in "$HOME/.bashrc" "$HOME/.zshrc"; do
+        if [ -f "$rc" ] && grep -qF '# tabby-remote-desktop' "$rc"; then
+            sed -i.trd-bak '/# tabby-remote-desktop$/d' "$rc" && rm -f "$rc.trd-bak"
+        fi
+    done
+    # Sessions already running keep going; new logins are plain again.
+    rm -f "$D/login.sh" "$D/tmux.conf" "$D/backend" "$D/bin/desk" "$D/bin/trd-pty"
+fi
+if [ ! -s "$D/rdp-password" ]; then
+    ( umask 077; od -An -N18 -tx1 /dev/urandom | tr -d ' \n' > "$D/rdp-password" ) || fail "could not create credentials"
+fi
+RD_USER=tabby
+RD_PASS=$(cat "$D/rdp-password")
+
+STATUS=$(grdctl --headless status --show-credentials 2>/dev/null)
+has () { printf '%s\n' "$STATUS" | grep -qxF "$(printf '\t%s' "$1")"; }
+g () { grdctl --headless rdp "$@" >/dev/null 2>&1; }
+RESTART=0
+if ! has "TLS key: $D/tls.key" || ! has "TLS certificate: $D/tls.crt"; then
+    g set-tls-key "$D/tls.key" && g set-tls-cert "$D/tls.crt" || fail "grdctl could not set the TLS certificate"
+    RESTART=1
+fi
+if ! has "View-only: no"; then g disable-view-only || fail "grdctl could not disable view-only"; RESTART=1; fi
+if ! has "Status: enabled"; then g enable || fail "grdctl could not enable RDP"; RESTART=1; fi
+if ! has "Username: $RD_USER" || ! has "Password: $RD_PASS"; then
+    g set-credentials "$RD_USER" "$RD_PASS" || fail "grdctl could not set credentials"
+    RESTART=1
+fi
+
+# Session identity for the headless shell: apps like Settings refuse to run without XDG_CURRENT_DESKTOP,
+# and xdg-open picks the desktop's handlers from it. Use Ubuntu's session mode when present (dock etc.).
+if [ -f /usr/share/gnome-shell/modes/ubuntu.json ]; then SESS=ubuntu; DESK=ubuntu:GNOME; else SESS=gnome; DESK=GNOME; fi
+SESSION_VERSION=2
+SHELL_PID=$(pgrep -u "$(id -u)" -f 'gnome-shell --headless' | head -1)
+if [ -n "$SHELL_PID" ] && ! tr '\0' '\n' < /proc/$SHELL_PID/environ 2>/dev/null | grep -qx "TABBY_RD_SESSION=$SESSION_VERSION"; then
+    # A shell from an older setup (no session identity): replace it (closes its windows).
+    kill "$SHELL_PID" 2>/dev/null
+    i=0; while [ $i -lt 40 ] && kill -0 "$SHELL_PID" 2>/dev/null; do sleep 0.25; i=$((i+1)); done
+    SHELL_PID=
+fi
+if [ -z "$SHELL_PID" ]; then
+    # Apps from a previous headless session (marked below) outlive their display; single-instance apps
+    # would then swallow new launches without showing a window. End them before starting afresh.
+    for p in $(pgrep -u "$(id -u)"); do
+        grep -qz '^TABBY_RD_SESSION=' /proc/$p/environ 2>/dev/null && kill "$p" 2>/dev/null
+    done
+    systemctl --user stop tabby-headless-shell >/dev/null 2>&1
+    systemctl --user reset-failed tabby-headless-shell >/dev/null 2>&1
+    systemd-run --user --unit=tabby-headless-shell --setenv=XDG_SESSION_TYPE=wayland \
+        --setenv=XDG_CURRENT_DESKTOP=$DESK --setenv=XDG_SESSION_DESKTOP=$SESS --setenv=DESKTOP_SESSION=$SESS \
+        --setenv=GNOME_SHELL_SESSION_MODE=$SESS --setenv=TABBY_RD_SESSION=$SESSION_VERSION \
+        gnome-shell --headless >/dev/null 2>&1 \
+        || fail "could not start a headless GNOME Shell"
+    i=0; while [ $i -lt 40 ] && ! busctl --user status org.gnome.Mutter.RemoteDesktop >/dev/null 2>&1; do sleep 0.25; i=$((i+1)); done
+    SHELL_PID=$(pgrep -u "$(id -u)" -f 'gnome-shell --headless' | head -1)
+    RESTART=1
+fi
+# What gnome-session does for a real login: let D-Bus/systemd-activated apps find this display.
+WL=$(tr '\0' '\n' < /proc/$SHELL_PID/environ 2>/dev/null | sed -n 's/^WAYLAND_DISPLAY=//p')
+[ -n "$WL" ] || WL=$(ls -t "$XDG_RUNTIME_DIR" 2>/dev/null | grep -m1 -x 'wayland-[0-9]*')
+dbus-update-activation-environment --systemd WAYLAND_DISPLAY=${"$"}{WL:-wayland-0} XDG_SESSION_TYPE=wayland \
+    XDG_CURRENT_DESKTOP=$DESK XDG_SESSION_DESKTOP=$SESS DESKTOP_SESSION=$SESS >/dev/null 2>&1
+# Mark D-Bus-activated apps as part of this session too (not in systemd's environment: user services would inherit it).
+dbus-update-activation-environment TABBY_RD_SESSION=$SESSION_VERSION >/dev/null 2>&1
+if [ $RESTART = 1 ] || ! systemctl --user is-active -q gnome-remote-desktop-headless.service; then
+    systemctl --user restart gnome-remote-desktop-headless.service >/dev/null 2>&1 || fail "could not start gnome-remote-desktop-headless"
+fi
+PORT=$(grdctl --headless status 2>/dev/null | awk '/Port:/ { print $2; exit }')
+PORT=${"$"}{PORT:-3389}
+i=0; while [ $i -lt 40 ] && ! ss -ltnH "sport = :$PORT" 2>/dev/null | grep -q .; do sleep 0.25; i=$((i+1)); done
+ss -ltnH "sport = :$PORT" 2>/dev/null | grep -q . || fail "nothing is listening on port $PORT"
+say "RD_OK port=$PORT user=$RD_USER pass=$RD_PASS"
+`;
+let trdPtySource = null;
+function trdPty() {
+    trdPtySource ??= fs.readFileSync(path.join(__dirname, '..', 'remote', 'trd-pty.py'), 'utf8');
+    return trdPtySource;
+}
+async function prepareRemoteDesktop(target, desk, backend = 'native') {
+    const script = `TRD_DESK=${desk ? 1 : 0}\nTRD_BACKEND=${backend === 'tmux' ? 'tmux' : 'native'}\n` +
+        SETUP_SCRIPT.replace('@@TRD_PTY_PY@@', trdPty().trimEnd());
+    const out = await target.exec('sh -s', script);
+    const err = /^RD_ERR (.*)$/m.exec(out);
+    if (err) {
+        throw new Error(err[1]);
+    }
+    const ok = /^RD_OK port=(\d+) user=(\S+) pass=(\S+)$/m.exec(out);
+    if (!ok) {
+        throw new Error('Remote setup gave no result');
+    }
+    return { port: Number(ok[1]), username: ok[2], password: ok[3] };
+}
+//# sourceMappingURL=remoteSetup.js.map

package/dist/remoteSetup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteSetup.js","sourceRoot":"","sources":["../src/remoteSetup.ts"],"names":[],"mappings":";;AAwLA,oDAaC;AArMD,yBAAwB;AACxB,6BAA4B;AAS5B,kHAAkH;AAClH,yGAAyG;AACzG,2GAA2G;AAC3G,yGAAyG;AACzG,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;QAiBvB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+DAqE2C,GAAG;;;;;;;;OAQ3D,GAAG;;;;CAIT,CAAA;AAMD,IAAI,YAAY,GAAkB,IAAI,CAAA;AACtC,SAAS,MAAM;IACX,YAAY,KAAK,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IAC5F,OAAO,YAAY,CAAA;AACvB,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAE,MAAoB,EAAE,IAAa,EAAE,UAA0B,QAAQ;IAC/G,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI;QAC9F,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,GAAG,EAAE,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,MAAM,EAAE,GAAG,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChE,IAAI,CAAC,EAAE,EAAE,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACpE,CAAC"}

package/dist/signin.js

@@ -0,0 +1,114 @@
+"use strict";
+/** Sign-in for desktops that use their own accounts (Windows): a form in the desktop layer, and the keychain. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STYLE = void 0;
+exports.loadCredentials = loadCredentials;
+exports.saveCredentials = saveCredentials;
+exports.forgetCredentials = forgetCredentials;
+exports.forgetCredentialsFor = forgetCredentialsFor;
+exports.askCredentials = askCredentials;
+const KEYCHAIN_SERVICE = 'tabby-rdp';
+// Tabby ships keytar (tabby-ssh keeps SSH passwords with it). Without it, nothing is remembered.
+function keytar() {
+    try {
+        return require('keytar');
+    }
+    catch {
+        return null;
+    }
+}
+/** Saved credentials for a desktop (keyed by its session key), or null. */
+async function loadCredentials(key) {
+    try {
+        const saved = await keytar()?.getPassword(KEYCHAIN_SERVICE, key);
+        const parsed = saved ? JSON.parse(saved) : null;
+        return parsed?.username && typeof parsed.password === 'string' ? { username: parsed.username, password: parsed.password } : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function saveCredentials(key, credentials) {
+    await keytar()?.setPassword(KEYCHAIN_SERVICE, key, JSON.stringify(credentials));
+}
+async function forgetCredentials(key) {
+    try {
+        await keytar()?.deletePassword(KEYCHAIN_SERVICE, key);
+    }
+    catch { }
+}
+/** Forgets saved accounts for a desktop on any SSH host (session keys ending in `#<id>`). */
+async function forgetCredentialsFor(desktopId) {
+    try {
+        const k = keytar();
+        for (const { account } of await k?.findCredentials(KEYCHAIN_SERVICE) ?? []) {
+            if (account.endsWith(`#${desktopId}`)) {
+                await k.deletePassword(KEYCHAIN_SERVICE, account);
+            }
+        }
+    }
+    catch { }
+}
+exports.STYLE = `
+.trd-signin { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; z-index: 1; }
+.trd-signin form { display: flex; flex-direction: column; gap: 10px; width: 300px; max-width: calc(100% - 32px); color: #ccc; font-size: 13px; }
+.trd-signin .trd-signin-title { font-size: 15px; color: #eee; }
+.trd-signin .trd-signin-error { color: #f08080; white-space: pre-line; }
+.trd-signin .trd-signin-error:empty { display: none; }
+.trd-signin label.trd-signin-remember { display: flex; gap: 6px; align-items: center; }
+.trd-signin .trd-signin-buttons { display: flex; gap: 8px; justify-content: flex-end; }
+`;
+/**
+ * Asks for the account in the desktop layer. Resolves with what was entered (and whether to remember it),
+ * or null when cancelled or when `abort` fires (the desktop was disconnected meanwhile).
+ */
+function askCredentials(layer, options, abort) {
+    const box = document.createElement('div');
+    box.className = 'trd-signin';
+    box.innerHTML = `
+        <form autocomplete="off">
+            <div class="trd-signin-title"></div>
+            <div class="trd-signin-error"></div>
+            <input class="form-control" name="username" placeholder="User name (or DOMAIN\\user)" spellcheck="false">
+            <input class="form-control" name="password" type="password" placeholder="Password">
+            <label class="trd-signin-remember"><input type="checkbox" name="remember" checked> Remember in the keychain</label>
+            <div class="trd-signin-buttons">
+                <button type="button" class="btn btn-secondary" name="cancel">Cancel</button>
+                <button type="submit" class="btn btn-primary">Connect</button>
+            </div>
+        </form>`;
+    const form = box.querySelector('form');
+    const field = (name) => form.querySelector(`[name="${name}"]`);
+    box.querySelector('.trd-signin-title').textContent = options.title;
+    box.querySelector('.trd-signin-error').textContent = options.error ?? '';
+    field('username').value = options.username ?? '';
+    if (!options.canRemember) {
+        field('remember').checked = false;
+        form.querySelector('.trd-signin-remember').style.display = 'none';
+    }
+    layer.appendChild(box);
+    // Focus goes to the form from DesktopSession.focusDesktop(), which also takes it back from Tabby.
+    return new Promise(resolve => {
+        const done = (result) => {
+            box.remove();
+            resolve(result);
+        };
+        form.addEventListener('submit', event => {
+            event.preventDefault();
+            const username = field('username').value.trim();
+            if (!username) {
+                field('username').focus();
+                return;
+            }
+            done({ username, password: field('password').value, remember: field('remember').checked });
+        });
+        field('cancel').addEventListener('click', () => done(null));
+        form.addEventListener('keydown', event => {
+            if (event.key === 'Escape') {
+                done(null);
+            }
+        });
+        abort.then(() => done(null));
+    });
+}
+//# sourceMappingURL=signin.js.map

package/dist/signin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin.js","sourceRoot":"","sources":["../src/signin.ts"],"names":[],"mappings":";AAAA,iHAAiH;;;AAmBjH,0CAQC;AAED,0CAEC;AAED,8CAIC;AAGD,oDASC;AAgBD,wCAqDC;AA/GD,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAEpC,iGAAiG;AACjG,SAAS,MAAM;IACX,IAAI,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,eAAe,CAAE,GAAW;IAC9C,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,EAAE,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,OAAO,MAAM,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACpI,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAE,GAAW,EAAE,WAAwB;IACxE,MAAM,MAAM,EAAE,EAAE,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;AACnF,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAE,GAAW;IAChD,IAAI,CAAC;QACD,MAAM,MAAM,EAAE,EAAE,cAAc,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;AACf,CAAC;AAED,6FAA6F;AACtF,KAAK,UAAU,oBAAoB,CAAE,SAAiB;IACzD,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAA;QAClB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;YACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;YACrD,CAAC;QACL,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;AACf,CAAC;AAEY,QAAA,KAAK,GAAG;;;;;;;;CAQpB,CAAA;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC1B,KAAkB,EAClB,OAAmF,EACnF,KAAoB;IAEpB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACzC,GAAG,CAAC,SAAS,GAAG,YAAY,CAAA;IAC5B,GAAG,CAAC,SAAS,GAAG;;;;;;;;;;;gBAWJ,CAAA;IACZ,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAE,CAAA;IACvC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAqB,CAAA;IAC1F,GAAG,CAAC,aAAa,CAAC,mBAAmB,CAAE,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAA;IACnE,GAAG,CAAC,aAAa,CAAC,mBAAmB,CAAE,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAA;IACzE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;IAChD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,GAAG,KAAK,CAAA;QACjC,IAAI,CAAC,aAAa,CAAc,sBAAsB,CAAE,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAA;IACnF,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACtB,kGAAkG;IAElG,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QACzB,MAAM,IAAI,GAAG,CAAC,MAAoD,EAAE,EAAE;YAClE,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,OAAO,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAA;QACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;YACpC,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAA;gBACzB,OAAM;YACV,CAAC;YACD,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9F,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE;YACrC,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,CAAC;QACL,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/ssh.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSSHTab = isSSHTab;
+exports.openTcpStream = openTcpStream;
+exports.execRemote = execRemote;
+const sshChannelStream_1 = require("./sshChannelStream");
+function isSSHTab(tab) {
+    // The profile is set when the tab is created; sshSession only once it connects.
+    return tab?.profile?.type === 'ssh' && !!tab.element?.nativeElement;
+}
+function client(tab) {
+    const ssh = tab.sshSession?.ssh;
+    if (!tab.sshSession?.open || typeof ssh?.openTCPForwardChannel !== 'function') {
+        throw new Error('The SSH connection is not open');
+    }
+    return ssh;
+}
+/** A direct-tcpip channel to host:port as the remote sees it (e.g. its own 127.0.0.1), as a Node stream. */
+async function openTcpStream(tab, host, port) {
+    const ssh = client(tab);
+    const channel = await ssh.activateChannel(await ssh.openTCPForwardChannel({
+        addressToConnectTo: host,
+        portToConnectTo: port,
+        originatorAddress: '127.0.0.1',
+        originatorPort: 0,
+    }));
+    return new sshChannelStream_1.SSHChannelStream(channel);
+}
+/** Runs `command` on the remote with `stdin`, returns stdout. No PTY, no exit status (russh doesn't expose it). */
+async function execRemote(tab, command, stdin = '', timeoutMs = 60000) {
+    const ssh = client(tab);
+    const channel = await ssh.activateChannel(await ssh.openSessionChannel());
+    const out = [];
+    const closed = new Promise(resolve => channel.closed$.subscribe(() => resolve()));
+    channel.data$.subscribe((d) => out.push(Buffer.from(d)));
+    await channel.requestExec(command);
+    if (stdin) {
+        await channel.write(new Uint8Array(Buffer.from(stdin)));
+    }
+    await channel.eof();
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`Remote command timed out after ${timeoutMs / 1000}s`)), timeoutMs);
+    });
+    try {
+        await Promise.race([closed, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+        channel.close().catch(() => null);
+    }
+    return Buffer.concat(out).toString('utf8');
+}
+//# sourceMappingURL=ssh.js.map

package/dist/ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../src/ssh.ts"],"names":[],"mappings":";;AAYA,4BAGC;AAWD,sCASC;AAGD,gCAsBC;AA1DD,yDAAqD;AAUrD,SAAgB,QAAQ,CAAE,GAAwC;IAC9D,gFAAgF;IAChF,OAAQ,GAAqB,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,IAAI,CAAC,CAAE,GAAc,CAAC,OAAO,EAAE,aAAa,CAAA;AACtG,CAAC;AAED,SAAS,MAAM,CAAE,GAAW;IACxB,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,CAAA;IAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,OAAO,GAAG,EAAE,qBAAqB,KAAK,UAAU,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,4GAA4G;AACrG,KAAK,UAAU,aAAa,CAAE,GAAW,EAAE,IAAY,EAAE,IAAY;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,qBAAqB,CAAC;QACtE,kBAAkB,EAAE,IAAI;QACxB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,WAAW;QAC9B,cAAc,EAAE,CAAC;KACpB,CAAC,CAAC,CAAA;IACH,OAAO,IAAI,mCAAgB,CAAC,OAAO,CAAC,CAAA;AACxC,CAAC;AAED,mHAAmH;AAC5G,KAAK,UAAU,UAAU,CAAE,GAAW,EAAE,OAAe,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,KAAK;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACzE,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACvF,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,KAAK,EAAE,CAAC;QACR,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAA;IACnB,IAAI,KAAiC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC7C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACjH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACzC,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC"}